CVE-2026-23419

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23419", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.014Z", "datePublished": "2026-04-03T13:24:23.958Z", "dateUpdated": "2026-10-30T12:24:06.599Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:24:06.599Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: Fix circular locking dependency in rds_tcp_tune\n\nsyzbot reported a circular locking dependency in rds_tcp_tune() where\nsk_net_refcnt_upgrade() is called while holding the socket lock:\n\n======================================================\nWARNING: possible circular locking dependency detected\n======================================================\nkworker/u10:8/15040 is trying to acquire lock:\nffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0},\nat: __kmalloc_cache_noprof+0x4b/0x6f0\n\nbut task is already holding lock:\nffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0},\nat: rds_tcp_tune+0xd7/0x930\n\nThe issue occurs because sk_net_refcnt_upgrade() performs memory\nallocation (via get_net_track() -> ref_tracker_alloc()) while the\nsocket lock is held, creating a circular dependency with fs_reclaim.\n\nFix this by moving sk_net_refcnt_upgrade() outside the socket lock\ncritical section. This is safe because the fields modified by the\nsk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not\naccessed by any concurrent code path at this point.\n\nv2:\n - Corrected fixes tag\n - check patch line wrap nits\n - ai commentary nits"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - RDS/TCP creates a listener on TCP port 16385, and an unauthenticated remote TCP connection reaches rds_tcp_accept_one() and rds_tcp_tune() before protocol-level validation. A local AF_RDS path also exists, but the highest reasonable vector is network.\nAC:L - The attacker can repeatedly trigger the vulnerable lock ordering by opening RDS/TCP connections; no special packet format, credentials, or attacker-uncontrolled race is needed to reach the bad allocation-under-socket-lock path. Applying the higher-severity rule, this is Low complexity.\nPR:N - The network accept path requires no local account, capabilities, or RDS authentication before rds_tcp_tune() is invoked. Remote reachability to the RDS/TCP listener is sufficient in a reasonable affected deployment.\nUI:N - No victim user action is required. The attacker can initiate the connection directly.\nS:U - The issue affects kernel locking within the same host security authority. It does not cross a VM, container, IOMMU, or other separate security scope boundary.\nC:N - The bug is a circular locking dependency involving sk_lock, sk_net_refcnt_upgrade(), ref_tracker allocation, and fs_reclaim. It does not expose kernel memory or create a read primitive.\nI:N - There is no memory corruption or write primitive; the fix only moves a refcount-tracker allocation outside the socket lock. Integrity is not directly impacted.\nA:H - The lock inversion can lead to a kernel deadlock or system hang, and syzbot reported it as a possible deadlock in the RDS accept worker. Kernel deadlock is High availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/tcp.c"], "versions": [{"version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "lessThan": "ce5be6703afd2ac2ff7dabd397137d71d22d4bc3", "status": "affected", "versionType": "git"}, {"version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "lessThan": "8babb271403378ba6836f6c8599c5313d0e2355d", "status": "affected", "versionType": "git"}, {"version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "lessThan": "8519e6883a942e510f33a0e634e27bcc3a844a40", "status": "affected", "versionType": "git"}, {"version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "lessThan": "6ce948fa54599f369ff7fe8b793a6aae4b0762b2", "status": "affected", "versionType": "git"}, {"version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "lessThan": "026bbaeeab9e04534ee58882b6447300629b42f6", "status": "affected", "versionType": "git"}, {"version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "lessThan": "6a877ececd6daa002a9a0002cd0fbca6592a9244", "status": "affected", "versionType": "git"}, {"version": "2a6efabed754c9dcf27e6def71317b374f58a852", "status": "affected", "versionType": "git"}, {"version": "5.17.7", "lessThan": "5.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/tcp.c"], "versions": [{"version": "5.18", "status": "affected"}, {"version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.77", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.77"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "7.0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17.7"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ce5be6703afd2ac2ff7dabd397137d71d22d4bc3"}, {"url": "https://git.kernel.org/stable/c/8babb271403378ba6836f6c8599c5313d0e2355d"}, {"url": "https://git.kernel.org/stable/c/8519e6883a942e510f33a0e634e27bcc3a844a40"}, {"url": "https://git.kernel.org/stable/c/6ce948fa54599f369ff7fe8b793a6aae4b0762b2"}, {"url": "https://git.kernel.org/stable/c/026bbaeeab9e04534ee58882b6447300629b42f6"}, {"url": "https://git.kernel.org/stable/c/6a877ececd6daa002a9a0002cd0fbca6592a9244"}], "title": "net/rds: Fix circular locking dependency in rds_tcp_tune", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rds/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ce5be6703afd2ac2ff7dabd397137d71d22d4bc3", "status": "affected", "version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "versionType": "git"}, {"lessThan": "8babb271403378ba6836f6c8599c5313d0e2355d", "status": "affected", "version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "versionType": "git"}, {"lessThan": "8519e6883a942e510f33a0e634e27bcc3a844a40", "status": "affected", "version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "versionType": "git"}, {"lessThan": "6ce948fa54599f369ff7fe8b793a6aae4b0762b2", "status": "affected", "version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "versionType": "git"}, {"lessThan": "026bbaeeab9e04534ee58882b6447300629b42f6", "status": "affected", "version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "versionType": "git"}, {"lessThan": "6a877ececd6daa002a9a0002cd0fbca6592a9244", "status": "affected", "version": "3a58f13a881ed351198ffab4cf9953cf19d2ab3a", "versionType": "git"}, {"status": "affected", "version": "2a6efabed754c9dcf27e6def71317b374f58a852", "versionType": "git"}, {"lessThan": "5.18", "status": "affected", "version": "5.17.7", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rds/tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"lessThan": "5.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.130", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.77", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.17", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "13A05898-2C81-4FD8-A692-D2E1418B0640", "versionEndExcluding": "5.18", "versionStartIncluding": "5.17.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "32BB513D-AB55-4C3B-8466-6992E214206D", "versionEndExcluding": "6.6.130", "versionStartIncluding": "5.18.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B3D12E00-E42D-4056-B354-BAD4903C03A5", "versionEndExcluding": "6.12.77", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5E006E4-59C7-43C1-9231-62A72219F2BA", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:*", "matchCriteriaId": "0384FA0A-DE99-48D7-84E3-46ED0C3B5E03", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: Fix circular locking dependency in rds_tcp_tune\n\nsyzbot reported a circular locking dependency in rds_tcp_tune() where\nsk_net_refcnt_upgrade() is called while holding the socket lock:\n\n======================================================\nWARNING: possible circular locking dependency detected\n======================================================\nkworker/u10:8/15040 is trying to acquire lock:\nffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0},\nat: __kmalloc_cache_noprof+0x4b/0x6f0\n\nbut task is already holding lock:\nffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0},\nat: rds_tcp_tune+0xd7/0x930\n\nThe issue occurs because sk_net_refcnt_upgrade() performs memory\nallocation (via get_net_track() -> ref_tracker_alloc()) while the\nsocket lock is held, creating a circular dependency with fs_reclaim.\n\nFix this by moving sk_net_refcnt_upgrade() outside the socket lock\ncritical section. This is safe because the fields modified by the\nsk_net_refcnt_upgrade() call (sk_net_refcnt, ns_tracker) are not\naccessed by any concurrent code path at this point.\n\nv2:\n - Corrected fixes tag\n - check patch line wrap nits\n - ai commentary nits"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/rds: Correcci\u00f3n de la dependencia de bloqueo circular en rds_tcp_tune\n\nsyzbot inform\u00f3 de una dependencia de bloqueo circular en rds_tcp_tune() donde se llama a sk_net_refcnt_upgrade() mientras se mantiene el bloqueo del socket:\n\n======================================================\nADVERTENCIA: posible dependencia de bloqueo circular detectada\n======================================================\nkworker/u10:8/15040 est\u00e1 intentando adquirir el bloqueo:\nffffffff8e9aaf80 (fs_reclaim){+.+.}-{0:0},\nen: __kmalloc_cache_noprof+0x4b/0x6f0\n\npero la tarea ya est\u00e1 manteniendo el bloqueo:\nffff88805a3c1ce0 (k-sk_lock-AF_INET6){+.+.}-{0:0},\nen: rds_tcp_tune+0xd7/0x930\n\nEl problema ocurre porque sk_net_refcnt_upgrade() realiza una asignaci\u00f3n de memoria (a trav\u00e9s de get_net_track() -> ref_tracker_alloc()) mientras se mantiene el bloqueo del socket, creando una dependencia circular con fs_reclaim.\n\nSolucione esto moviendo sk_net_refcnt_upgrade() fuera de la secci\u00f3n cr\u00edtica del bloqueo del socket. Esto es seguro porque los campos modificados por la llamada a sk_net_refcnt_upgrade() (sk_net_refcnt, ns_tracker) no son accedidos por ninguna ruta de c\u00f3digo concurrente en este punto.\n\nv2:\n - Etiqueta de correcciones corregida\n - revisar peque\u00f1os errores de ajuste de l\u00ednea del parche\n - peque\u00f1os errores en los comentarios de ai"}], "id": "CVE-2026-23419", "lastModified": "2026-10-30T13:18:38.410", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-03T14:16:27.843", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/026bbaeeab9e04534ee58882b6447300629b42f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6a877ececd6daa002a9a0002cd0fbca6592a9244"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6ce948fa54599f369ff7fe8b793a6aae4b0762b2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8519e6883a942e510f33a0e634e27bcc3a844a40"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8babb271403378ba6836f6c8599c5313d0e2355d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ce5be6703afd2ac2ff7dabd397137d71d22d4bc3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net/rds: Fix circular locking dependency in rds_tcp_tune", "id": "2454774", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454774"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["A flaw was found in the Linux kernel's `net/rds` module. This vulnerability involves a circular locking dependency within the `rds_tcp_tune()` function. The issue arises when the `sk_net_refcnt_upgrade()` function performs memory allocation while a socket lock is held, creating a deadlock with the `fs_reclaim` lock. This can lead to system unresponsiveness or crashes, resulting in a Denial of Service (DoS) condition."], "name": "CVE-2026-23419", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23419\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23419\nhttps://lore.kernel.org/linux-cve-announce/2026040303-CVE-2026-23419-6055@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,8babb271403378ba6836f6c8599c5313d0e2355d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,8519e6883a942e510f33a0e634e27bcc3a844a40)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,6ce948fa54599f369ff7fe8b793a6aae4b0762b2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,026bbaeeab9e04534ee58882b6447300629b42f6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3a58f13a881ed351198ffab4cf9953cf19d2ab3a,6a877ececd6daa002a9a0002cd0fbca6592a9244)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "2a6efabed754c9dcf27e6def71317b374f58a852"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.77,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T08:57:23.413317+00:00", "value": {"mitigation_remediation": ["Apply the latest kernel update that includes the rds_tcp_tune lock fix", "If updating is not immediately possible, disable the RDS protocol or related services to prevent the lock condition", "Monitor system logs for lock contention or deadlock warnings and address any anomalies promptly"], "summary": {"action": "Apply Patch", "impact": "Potential deadlock causing denial of service in Linux kernel RDS TCP module"}, "threat_synthesis": {"affected_systems": "All Linux kernel distributions before the commit that introduced the lock fix are affected. The issue has been reported for both the generic Linux kernel and the Linux kernel for Linux-based systems. No specific version range is listed, so any kernel version that has not yet merged the patch is vulnerable.", "description_and_impact": "A circular locking dependency exists in the RDS TCP implementation of the Linux kernel; the function sk_net_refcnt_upgrade() performs memory allocation while holding the socket lock, creating a situation where the task can be stalled by another lock, leading to deadlock. This weakness aligns with CWE\u2011833 and also demonstrates characteristics of CWE\u2011667, a race condition that can cause inconsistent state or deadlock. The flaw can lead to a denial\u2011of\u2011service if the lock order is repeatedly violated.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.5, indicating a high severity level. The estimated probability of exploitation is less than 1 percent, and it is not currently listed in CISA KEV. The attack vector is inferred to require traffic that triggers rds_tcp_tune, limiting exposure to environments where the RDS protocol is active. The flaw primarily threatens availability, potentially leading to blocking of RDS connections or a kernel-level deadlock that can disable network services."}}}}, "created": "2026-04-03T21:14:20.434561+00:00", "updated": "2026-04-28T09:00:06.536002+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}